Vulnerability Name:

CVE-2022-3123 (CCN-235315)

Assigned:2022-09-02
Published:2022-09-02
Updated:2022-09-29
Summary:Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
5.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2022-3123

Source: XF
Type: UNKNOWN
dokuwiki-cve20223123-xss(235315)

Source: CCN
Type: DokuWiki GIT Repository
SECURITY fix difftype handling. #3761

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/splitbrain/dokuwiki/commit/63e9a247c072008a031f9db39fa496f6aca489b6

Source: CONFIRM
Type: Exploit, Issue Tracking, Patch, Third Party Advisory
https://huntr.dev/bounties/d72a979b-57db-4201-9500-66b49a5c1345

Source: CCN
Type: huntr Web site
Reflected XSS via POST in splitbrain/dokuwiki

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-fd641dbf35

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-8c76e587f7

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-d048c0dde2

Source: CCN
Type: DokuWiki Web site
DokuWiki

Source: CCN
Type: Mend Vulnerability Database
CVE-2022-3123

Vulnerable Configuration:Configuration 1:
  • cpe:/a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:* (Version < 2022-07-31a)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:36:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:37:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:dokuwiki:dokuwiki:2014-05-05a:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2011-05-25a:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2010-11-07a:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2009-12-25:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2009-02-14b:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2009-02-14:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-10-19:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-09-30:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-09-25:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-09-12:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-08-22:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-08-15a:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-08-08:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-07-25:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2004-07-21:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2014-09-29c:*:*:*:*:*:*:*
  • OR cpe:/a:dokuwiki:dokuwiki:2016-06-26a:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    dokuwiki dokuwiki *
    fedoraproject fedora 35
    fedoraproject fedora 36
    fedoraproject fedora 37
    dokuwiki dokuwiki 2014-05-05a
    dokuwiki dokuwiki 2011-05-25a
    dokuwiki dokuwiki 2010-11-07a
    dokuwiki dokuwiki 2009-12-25
    dokuwiki dokuwiki 2009-02-14b
    dokuwiki dokuwiki 2009-02-14
    dokuwiki dokuwiki 2004-10-19
    dokuwiki dokuwiki 2004-09-30
    dokuwiki dokuwiki 2004-09-25
    dokuwiki dokuwiki 2004-09-12
    dokuwiki dokuwiki 2004-08-22
    dokuwiki dokuwiki 2004-08-15a
    dokuwiki dokuwiki 2004-08-08
    dokuwiki dokuwiki 2004-07-25
    dokuwiki dokuwiki 2004-07-21
    dokuwiki dokuwiki 2014-09-29c
    dokuwiki dokuwiki 2016-06-26a